need same domain auth when wildcard domain auth about acme4j HOT 3 CLOSED

The ACME server sends two authorizations. One authorization is for example.com, and accepts all three kind of challenges. The other authorization is for *.example.com and only accepts dns-01.

To be on the safe side, you should perform the first authorization. After that, check the status of the second authorization. If the second one isn't VALID, you'll also have to complete that one.

It's not acme4j, the behavior comes from the ACME server.

from acme4j.

I understand. Thanks.

from acme4j.

One other note: If you look closely the Let's Encrypt server sends back one authorization with a (non-standard, not present in the ACME specification) field "wildcard":"true" for the authorization with only a DNS-01 challenge. That's another small signal that it isn't the same authorization as the one with a DNS-01, HTTP-01, and TLS-SNI-01 challenge for the base domain that isn't a wildcard.

Hope that helps!

from acme4j.